CVE-2026-98543

A vulnerability exists in the Linux kernel where bpf_lsm_has_d_inode_locked() incorrectly assumes the inode is locked during path_unlink and path_rmdir hooks. Because security_path_unlink() and security_path_rmdir() execute before the i_rwsem is acquired, a sleepable BPF LSM program can mutate ex...

CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

CVE-2026-98543

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

EUVD-2026-103588

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...